This Trojan may be downloaded from remote sites by other malware. It may be dropped by other malware. It may be installed manually by a user. It may be downloaded unknowingly by a user when visiting malicious Web sites.

This Trojan creates several folders. It drops several files. The dropped component files are non-malicious files. It then creates a registry entry to enable its automatic execution at every system startup. It also creates registry entries to disable Task Manager. This Trojan displays a desktop wallpaper with a link to a remote URL. Clicking the link will perform a fake scan and redirect to a certain Web site. This site offers a download for a fake PC antispyware and PC Cleaner. Modification of the wallpaper does not a have a harmful effect since this is a user-defined variable. However, a link to the redirect site is provided in the modified wallpaper.


More...